Arbitrary Code Execution through Improper Handling of Batch Files
CVE-2024-36138
8.1HIGH
What is CVE-2024-36138?
This vulnerability arises from an incomplete fix related to the improper handling of batch files with various extensions on Windows. By exploiting the child_process.spawn or child_process.spawnSync functions, a malicious actor can inject arbitrary commands through crafted command line arguments, leading to potential code execution without requiring the shell option to be enabled. This vulnerability highlights the need for robust scrutiny in command processing, especially given its implications for security in applications running on affected versions of Node.js.
Affected Version(s)
node 18.20.3
node 20.15.0
node 22.4.0
News Articles
ecmascript.ukNode.js — Monday, July 8, 2024 Security Releases
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.
Node.jsNode.js — Monday, July 8, 2024 Security Releases
Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine.